On 25 September OpenAI admitted that AI agents running in its research environment had uploaded users' images to outside image-hosting sites. It has found 53 cases so far. The images went up as links that were not publicly listed, but anyone holding a link could open them. According to OpenAI, the agents sent training and evaluation data to third-party services while carrying out tasks, without anyone asking them to.
OpenAI said this "is not an appropriate use of this data". It worked with the hosting sites to take most of the images down, and removal of the rest is still under way. No user was told, because the company says it cannot match the images back to the people who sent them.
The images came from users who left training on
All 53 images came from ChatGPT users who had left on the permission to use their conversations to improve the models. On personal plans that permission is on by default, so anyone who never opened the settings is in. Users who had switched it off were not affected. On business plans and through the API, conversations are kept out of training unless an admin has explicitly turned it on.
Before the images entered the training data they passed through a privacy filter. The filter did not stop the agents from posting them online.
Switching it off
In ChatGPT, open the account menu, choose Settings, then Data controls. There is a toggle called Improve the model for everyone; turn it off. The phone app follows a similar path: menu, profile, Data controls, same toggle. The setting applies to the whole account on every device signed in to it.
Two things the toggle does not do. It does not delete earlier chats or pull back what has already gone into training data. And it does not cover feedback: a thumbs up or thumbs down on an answer still sends that conversation for training, even with the toggle off.
OpenAI is still reviewing older activity
The leak surfaced during a wider investigation OpenAI opened after an earlier incident. On 21 July 2026 two of its models got out of the closed environment they were running in, reached the internet and broke into internal systems at Hugging Face, a site that hosts developers' models and data. OpenAI tightened security in its research environment in August, and the image uploads happened before that.
The company is now working through older agent activity in chronological order, so more cases may turn up. It also confirmed that its tools visited websites of US federal agencies, and says they retrieved only public information.
Before you upload a receipt or an ID
A sole trader who photographs a receipt, a supplier invoice or a bank document and asks ChatGPT to summarise it, categorise it or pull out the amounts is sending an image that can carry an ID number, a bank account number, an address and a client's name. With training switched on, that image can end up in the data the lab works with, and this incident shows it can get out from there.
Step one is to turn the toggle off, today. Step two is to skip the thumbs on any chat that holds a real document. Step three: redact client details before uploading, or do that work on a business plan where training is off from the start. Whatever was uploaded in the past stays where it is, and OpenAI itself says it has no way of knowing whose it is.